Is Yourwebhoster.eu down?

Following the announcement of critical PHP security vulnerabilities, **we are temporarily taking all servers offline as a precaution**. Services hosted on these servers will be unavailable during this period while we prioritise securing our infrastructure. Security fixes are scheduled for **21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time)**. Our infrastructure uses **Plesk, DirectAdmin and cPanel**, alongside **CloudLinux-provided PHP versions**. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore **not an estimated restoration time**. We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Servers will be brought back online after the required updates and checks have been completed. **We cannot yet provide a confirmed restoration time.** We will publish progress and service-restoration updates on this status page. **For support or questions, please email [email protected].** Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible. We apologise for the disruption and appreciate your patience.

## Critical PHP security update — temporary website and panel downtime Following the announcement of critical PHP security vulnerabilities, **we are temporarily taking websites, web applications, hosting control panels and our customer panel offline as a precaution** while we prioritise securing our infrastructure. ### Which services are affected? - **Websites and web applications:** WordPress websites, including their administration dashboards, other hosted websites, web applications and their associated APIs will be temporarily unavailable. - **Hosting control panels:** Access to **Plesk, DirectAdmin and cPanel** will be temporarily unavailable. You will not be able to manage your hosting services through these panels during this period. - **Our customer panel:** Our customer panel will also be temporarily unavailable. Please contact us directly at **[email protected]** for support during this period. - **Webmail:** Browser-based email access may also be unavailable, even where the underlying email service remains operational. **In most cases, sending and receiving email through email applications such as Outlook, Apple Mail and mobile mail apps is expected to continue working.** However, availability may vary by server, and temporary email interruptions may occur during maintenance. ### Updates and service restoration Security fixes are scheduled for **21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time)**. Our infrastructure uses **Plesk, DirectAdmin and cPanel**, alongside **CloudLinux-provided PHP versions**. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore **not an estimated restoration time**. We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Affected services will be brought back online after the required updates and checks have been completed. **We cannot yet provide a confirmed restoration time.** **All progress and service-restoration updates will be published at [status.yourwebhoster.eu](https://status.yourwebhoster.eu). We recommend subscribing to updates on this status page so that you are automatically notified of new developments.** ### Contact and support **For support or questions, please email [email protected].** Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible. We apologise for the disruption and appreciate your patience.

PHP has now released the security updates, and **we are updating servers where patched packages are available**. We will update the remaining servers as soon as their vendors release the required packages. There is still **no confirmed ETA for full service restoration**. Temporary mitigations have not been fully validated by us and should not be considered a complete fix. They may make exploitation harder, but exploitation may still be possible. We understand the impact on your business. Our own services and operations are also affected, and restoring services as quickly and safely as possible remains our priority.

PHP has released the security updates, but our vendors, including **CloudLinux**, need time to prepare and distribute updated packages for their platforms. Meanwhile, we are checking each server individually and **applying updates where available**. Each server will be brought back online as soon as its required updates and security checks are complete.

We are still waiting for **CloudLinux PHP updates**. Patched packages have been released for some PHP versions, but remain unavailable for most, including versions still officially supported by the PHP project. **We are updating servers wherever the required packages are available.** We understand the significant impact of this downtime. However, bringing affected websites back online before patching would expose them to a serious risk of **being hacked—meaning an attacker could gain unauthorised access to your website and its data**. Depending on the access gained, an attacker could steal sensitive information, including customer data; change or delete website files and databases; or use your website to spread malware or host scams. This could harm your visitors, damage your business’s reputation and cause data loss. Recovering from an attack could also result in a much longer outage while your website is cleaned and restored. **This describes the potential risks, not confirmation that your website has been hacked.** All our web hosting servers run **Imunify360**, although not every managed server has this protection. A web application firewall (WAF) may block certain malicious requests, but **it does not fix the underlying vulnerability**. Vendors’ protection against known attack patterns should not be interpreted as protection against every possible exploit. Unknown or modified attack patterns may bypass those rules, leaving unpatched websites vulnerable. These mitigations are an additional safeguard, not a substitute for installing the PHP security updates. **We have therefore kept affected services offline rather than relying on mitigations alone.** We continue to assess each server individually and will bring each service back online only after the required PHP security updates have been installed and the necessary security checks are complete. Thank you for your continued patience.

CloudLinux has acknowledged that its earlier release information was incorrect: the announced updates were for **TuxCare**, not the CloudLinux PHP packages we need. CloudLinux has now provided installation instructions that **differ from the usual update process**. We are reviewing these instructions and preparing to deploy the updates **as soon as possible**. Affected services will be restored after installation and security checks. There is still no confirmed restoration time.

We've now resolved the incident. Thanks for your patience.

We're rolling out a precautionary mitigation for a recently disclosed Linux KVM kernel vulnerability — "Januscape" (CVE-2026-53359, and the related CVE-2026-46113). The work is performed as rolling, live-migrated maintenance, so no downtime is expected for most workloads. As part of this mitigation, we are temporarily disabling nested virtualization. Workloads that rely on nesting — running VMs or virtualization-based features inside a VM — may experience errors or reduced functionality until it's restored. This measure is temporary. We will revert it and re-enable nested virtualization as soon as the patched kernel update is available. Updates will be posted here.

We have updated all nodes and removed the mitigation.

cPanel has released an update for cPanel servers. All managed servers have been updated. This release addresses vulnerabilities across versions of cPanel & WHM, including fixes for several vulnerabilities rated up to High severity. The following versions are patched: - v11.134.0.44 and greater - v11.126.0.77 and greater - v11.110.0.134 and greater - v11.136.0.28 and greater Kindly refer to the [support article](https://support.cpanel.net/hc/en-us/articles/41806964467095-Symlinks-that-are-not-accessible-via-SSH-are-accessible-via-File-Manager) for patched versions, remediation and mitigation steps, and ongoing updates. [Changelog](https://docs.cpanel.net/changelogs/136-change-log/)

All webhosting, reseller webhosting and managed servers are updated and protected against these vulnerabilities.